Icefire
IceFire is a ransomware group first observed in 2022 that expanded to Linux in early 2023 by exploiting a vulnerability in IBM Aspera Faspex (CVE-2022-47986), targeting media and entertainment organizations in Turkey, Iran, Pakistan, and the UAE using double-extortion tactics.
Victims
11
First Victim
2022-08-20
(est. attack date)
Discovery Date
2022-08-20
Last Seen
2022-08-20
Inactive Since
4yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
63.6%
victims with domain
Countries
0
hit
Uptime
0.0% avg (30d)
Known Locations (2)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
Leakage List | No | 2026-08-22T09:01:34 |
kf6x3mjeqljqxjznaw65jixin7dpcunfxbbakwuitizytcpzn4iy5bad.onion
|
||||
|
Leakage List | No | 2026-08-22T09:01:48 |
7kstc545azxeahkduxmefgwqkrrhq3mzohkzqvrv7aekob7z3iwkqvyd.onion
|
Target
Top 5 Activity Sectors
- Technology 7
- Education 1
- Financial Services 1
- Retail & E-Commerce 1
- Manufacturing 1
Top 5 Countries
Heatmap
Ransom Notes (1)
YARA Rules (1)
Victims (11)
